From: Michihiro NAKAJIMA <ggcueroad@gmail.com>
Date: Wed, 3 Aug 2011 12:09:01 +0000 (-0400)
Subject: Further sanity checks and properly invoke __archive_read_ahead before __archive_read_... 
X-Git-Tag: v3.0.0a~203
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1b4098d88d2cf66698c54dff652f5d37b305b897;p=thirdparty%2Flibarchive.git

Further sanity checks and properly invoke __archive_read_ahead before __archive_read_consume is called when
a header size extend.

SVN-Revision: 3530
---

diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index 7ee4ad7c7..d76dcb213 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -431,12 +431,26 @@ archive_read_format_rar_read_header(struct archive_read *a,
     case MAIN_HEAD:
       rar->main_flags = archive_le16dec(p + 3);
       skip = archive_le16dec(p + 5);
+      if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)) {
+        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+          "Invalid header size");
+        return (ARCHIVE_FATAL);
+      }
+      if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
+        return (ARCHIVE_FATAL);
+      p = h;
       memcpy(rar->reserved1, p + 7, sizeof(rar->reserved1));
       memcpy(rar->reserved2, p + 7 + sizeof(rar->reserved1),
              sizeof(rar->reserved2));
-      if (rar->main_flags & MHD_ENCRYPTVER)
+      if (rar->main_flags & MHD_ENCRYPTVER) {
+        if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)+1) {
+          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+            "Invalid header size");
+          return (ARCHIVE_FATAL);
+        }
         rar->encryptver = *(p + 7 + sizeof(rar->reserved1) +
                             sizeof(rar->reserved2));
+      }
 
       if (rar->main_flags & MHD_VOLUME ||
           rar->main_flags & MHD_FIRSTVOLUME)
@@ -469,12 +483,26 @@ archive_read_format_rar_read_header(struct archive_read *a,
     case SIGN_HEAD:
       flags = archive_le16dec(p + 3);
       skip = archive_le16dec(p + 5);
+      if (skip < 7) {
+        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+          "Invalid header size");
+        return (ARCHIVE_FATAL);
+      }
+      if (skip > 7) {
+        if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
+          return (ARCHIVE_FATAL);
+        p = h;
+      }
       if (flags & HD_ADD_SIZE_PRESENT)
       {
-        if ((h = __archive_read_ahead(a, 13, NULL)) == NULL)
+        if (skip < 7 + 4) {
+          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+            "Invalid header size");
           return (ARCHIVE_FATAL);
-        p = h;
+        }
         skip += archive_le32dec(p + 7);
+        if (__archive_read_ahead(a, skip, NULL) == NULL)
+          return (ARCHIVE_FATAL);
       }
       __archive_read_consume(a, skip);
       if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)